For ConnectOnDemand fake a source IP address (10.10.0.10 and so on?) and after connection establishment change the source IP of all outgoing packets to the real source IP. At least, I think this is the correct way to create the default route when not connected (waiting for the first outgoing packet initiating the Up() event).

Note: Our new netstack will probably provide a very nice API for ConnectOnDemand, so we don't have to do these hacks.